user.js for Bugzilla

classic Classic list List threaded Threaded
7 messages Options
Reply | Threaded
Open this post in threaded view
|

user.js for Bugzilla

Gervase Markham
Is the following idea dumb or brilliant? :-)

What if Bugzilla (perhaps via an extension initially) had a textbox in
which users could write JS, and it would be loaded on all page loads?
Sort of like a cross-browser, site-specific Greasemonkey. People could
then share "recipes" (functions) for useful additions. For example, the
Bugzilla team could have a recipe which automatically set the Target
Milestone of a bug to the current milestone when resolving a bug as
FIXED, thereby saving LpSolit a job ;-) We could even provide a little
library help to make common tasks easier, like providing the ability to
register callbacks for events like "submitted bug change".

Gerv


_______________________________________________
dev-apps-bugzilla mailing list
[hidden email]
https://lists.mozilla.org/listinfo/dev-apps-bugzilla
-
To view or change your list settings, click here:
<http://bugzilla.org/cgi-bin/mj_wwwusr?user=lists+s6506n84121h51@...>
Reply | Threaded
Open this post in threaded view
|

Re: user.js for Bugzilla

Jochen Wiedmann
Sounds very much like duplicating both

a) Greasemonkey to me, with lots of possibilities for XSS attacks as a bonus and
b) superceding the existing extension system.

I'd be -1.

Sorry,

Jochen




On Tue, Dec 9, 2014 at 2:57 PM, Gervase Markham <[hidden email]> wrote:

> Is the following idea dumb or brilliant? :-)
>
> What if Bugzilla (perhaps via an extension initially) had a textbox in
> which users could write JS, and it would be loaded on all page loads?
> Sort of like a cross-browser, site-specific Greasemonkey. People could
> then share "recipes" (functions) for useful additions. For example, the
> Bugzilla team could have a recipe which automatically set the Target
> Milestone of a bug to the current milestone when resolving a bug as
> FIXED, thereby saving LpSolit a job ;-) We could even provide a little
> library help to make common tasks easier, like providing the ability to
> register callbacks for events like "submitted bug change".
>
> Gerv
>
>
> _______________________________________________
> dev-apps-bugzilla mailing list
> [hidden email]
> https://lists.mozilla.org/listinfo/dev-apps-bugzilla
> -
> To view or change your list settings, click here:
> <http://bugzilla.org/cgi-bin/mj_wwwusr?user=jochen.wiedmann@...>



--
Our time is just a point along a line that runs forever with no end.
(Al Stewart, Lord Grenville)
_______________________________________________
dev-apps-bugzilla mailing list
[hidden email]
https://lists.mozilla.org/listinfo/dev-apps-bugzilla
-
To view or change your list settings, click here:
<http://bugzilla.org/cgi-bin/mj_wwwusr?user=lists+s6506n84121h51@...>
Reply | Threaded
Open this post in threaded view
|

Re: user.js for Bugzilla

Denis Roy
On 12/09/2014 11:33 AM, Jochen Wiedmann wrote:
> Sounds very much like duplicating both
>
> a) Greasemonkey to me, with lots of possibilities for XSS attacks as a bonus and
> b) superceding the existing extension system.
>
> I'd be -1.

+1 on that -1


We have dev teams who share GreaseMonkey scripts... perhaps have a way
for users of an installation to share those?
-
To view or change your list settings, click here:
<http://bugzilla.org/cgi-bin/mj_wwwusr?user=lists+s6506n84121h51@...>
Reply | Threaded
Open this post in threaded view
|

Re: user.js for Bugzilla

Gervase Markham
In reply to this post by Jochen Wiedmann
On 09/12/14 16:33, Jochen Wiedmann wrote:
> Sounds very much like duplicating both
>
> a) Greasemonkey to me,

Greasemonkey isn't available for all browsers.

> with lots of possibilities for XSS attacks as a bonus and

How so?

> b) superceding the existing extension system.

End users can't install extensions.

Gerv
-
To view or change your list settings, click here:
<http://bugzilla.org/cgi-bin/mj_wwwusr?user=lists+s6506n84121h51@...>
Reply | Threaded
Open this post in threaded view
|

Re: user.js for Bugzilla

Mark Côté
In reply to this post by Jochen Wiedmann
On 2014-12-09 11:37 AM, Denis Roy wrote:

> On 12/09/2014 11:33 AM, Jochen Wiedmann wrote:
>> Sounds very much like duplicating both
>>
>> a) Greasemonkey to me, with lots of possibilities for XSS attacks as a
>> bonus and
>> b) superceding the existing extension system.
>>
>> I'd be -1.
>
> +1 on that -1
>
>
> We have dev teams who share GreaseMonkey scripts... perhaps have a way
> for users of an installation to share those?

Not keen about this either.  It sounds like a support nightmare if
everyone has their own custom JS.  It's bad enough right now with only a
couple Bugzilla-specific add-ons.

Mark

_______________________________________________
dev-apps-bugzilla mailing list
[hidden email]
https://lists.mozilla.org/listinfo/dev-apps-bugzilla
-
To view or change your list settings, click here:
<http://bugzilla.org/cgi-bin/mj_wwwusr?user=lists+s6506n84121h51@...>
Reply | Threaded
Open this post in threaded view
|

Re: user.js for Bugzilla

Gervase Markham
On 09/12/14 16:49, Mark Côté wrote:
> Not keen about this either.  It sounds like a support nightmare if
> everyone has their own custom JS.  It's bad enough right now with only a
> couple Bugzilla-specific add-ons.

If it were built into Bugzilla, we could put a simple "off switch" on
each page, to reload the page without it. Then, if anyone had a problem,
we could simply say "can you reproduce it with your customizations
turned off?". At the moment, there's no control at all.

Also, if it were built into Bugzilla, we could offer common libraries to
simplify common tasks, like a callback hook for registering "bug submit"
events (where I could e.g. check if it was a Bugzilla product bug being
RESOLVED FIXED, and set the TM if so). If Greasemonkey scripts are used,
stuff like that has to be duplicated in each script, because scripts
can't reliably reference one another or guarantee presence.

Gerv

-
To view or change your list settings, click here:
<http://bugzilla.org/cgi-bin/mj_wwwusr?user=lists+s6506n84121h51@...>
Reply | Threaded
Open this post in threaded view
|

Re: user.js for Bugzilla

Frédéric Buclin
In reply to this post by Mark Côté
Le 09. 12. 14 17:49, Mark Côté a écrit :
> Not keen about this either.

I'm opposed to this too. Too easy to shoot yourself in the foot. And if
someone manages to put evil JS code, you are vulnerable to XSS or worse.

And your example about setting the TM automatically is bad. ;) It's too
easy to forget to set it and let Bugzilla guess what the TM must be.
It's much easier to track bugs with no TM set than to track bugs with
the wrong TM set.

LpSolit

-
To view or change your list settings, click here:
<http://bugzilla.org/cgi-bin/mj_wwwusr?user=lists+s6506n84121h51@...>